mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-05-30 12:29:55 +00:00
Code Issues Projects Releases Wiki Activity

bind: CVE-2015-8704 and CVE-2015-8705

Browse Source 
CVE-2015-8704:
Allows remote authenticated users to cause a denial of service via a malformed Address Prefix List record

CVE-2015-8705:
When debug logging is enabled, allows remote attackers to cause a denial of service or have possibly unspecified impact via OPT data or ECS option

[YOCTO 8966]

References:
https://kb.isc.org/article/AA-01346/0/BIND-9.10.3-P3-Release-Notes.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8704
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8705

(From OE-Core rev: 78ceabeb2df55194f16324d21ba97e81121f996b)

Signed-off-by: Derek Straka <derek@asterius.io>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Derek Straka
2016-01-25 14:15:28 -05:00
committed by Richard Purdie
parent d632a923dc
commit 049b7db30c
3 changed files with 74 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-connectivity/bind/bind/CVE-2015-8704.patch
+28
View File
@@ -0,0 +1,28 @@
a buffer size check can cause denial of service under certain circumstances
[security]
The following flaw in BIND was reported by ISC:
A buffer size check used to guard against overflow could cause named to exit with an INSIST failure In apl_42.c.
A server could exit due to an INSIST failure in apl_42.c when performing certain string formatting operations.
Upstream-Status: Backport
CVE: CVE-2015-8704
[The patch is taken from BIND 9.10.3:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-8704]
Signed-off-by: Derek Straka <derek@asterius.io>
diff --git a/lib/dns/rdata/in_1/apl_42.c b/lib/dns/rdata/in_1/apl_42.c
index bedd38e..28eb7f2 100644
--- a/lib/dns/rdata/in_1/apl_42.c
+++ b/lib/dns/rdata/in_1/apl_42.c
@@ -116,7 +116,7 @@ totext_in_apl(ARGS_TOTEXT) {
isc_uint8_t len;
isc_boolean_t neg;
unsigned char buf[16];
- char txt[sizeof(" !64000")];
+ char txt[sizeof(" !64000:")];
const char *sep = "";
int n;
meta/recipes-connectivity/bind/bind/CVE-2015-8705.patch
+44
View File
@@ -0,0 +1,44 @@
a crash or assertion failure can during format processing
[security]
The following flaw in BIND was reported by ISC:
In versions of BIND 9.10, errors can occur when OPT pseudo-RR data or ECS options are formatted to text. In 9.10.3 through 9.10.3-P2, the issue may result in a REQUIRE assertion failure in buffer.c.
This issue can affect both authoritative and recursive servers if they are performing debug logging. (It may also crash related tools which use the same code, such as dig or delv.)
A server could exit due to an INSIST failure in apl_42.c when performing certain string formatting operations.
Upstream-Status: Backport
CVE: CVE-2015-8705
[The patch is taken from BIND 9.10.3:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-8705]
Signed-off-by: Derek Straka <derek@asterius.io>
diff --git a/lib/dns/message.c b/lib/dns/message.c
index ea7b93a..810c58e 100644
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -3310,9 +3310,19 @@
} else if (optcode == DNS_OPT_SIT) {
ADD_STRING(target, "; SIT");
} else if (optcode == DNS_OPT_CLIENT_SUBNET) {
+ isc_buffer_t ecsbuf;
ADD_STRING(target, "; CLIENT-SUBNET: ");
- render_ecs(&optbuf, target);
- ADD_STRING(target, "\n");
+ isc_buffer_init(&ecsbuf,
+ isc_buffer_current(&optbuf),
+ optlen);
+ isc_buffer_add(&ecsbuf, optlen);
+ result = render_ecs(&ecsbuf, target);
+ if (result == ISC_R_NOSPACE)
+ return (result);
+ if (result == ISC_R_SUCCESS) {
+ isc_buffer_forward(&optbuf, optlen);
+ ADD_STRING(target, "\n");
+ }
continue;
} else if (optcode == DNS_OPT_EXPIRE) {
if (optlen == 4) {
meta/recipes-connectivity/bind/bind_9.10.2-P4.bb
+2
View File
@@ -21,6 +21,8 @@ SRC_URI = "ftp://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.gz \
file://bind-ensure-searching-for-json-headers-searches-sysr.patch \
file://0001-gen.c-extend-DIRNAMESIZE-from-256-to-512.patch \
file://0001-lib-dns-gen.c-fix-too-long-error.patch \
file://CVE-2015-8704.patch \
file://CVE-2015-8705.patch \
"
SRC_URI[md5sum] = "8b1f5064837756c938eadc1537dec5c7"